vgsp: eng62 - fill missing golden SA entries (slot 34 DRAW_IAB = IR 0x265), default off

The golden overlay writes all 55 slot bodies, but the CALL_MME_MACRO(34)
DRAW_IAB run targets SA[34]; the client's captured SA table only covered
slots 0-11 (c772), so slot 34 resolved to IR 0 (the slot-0 body) and the
macro never produced mac=0x22. Add sema_gl_mme_sa_golden_fill (bool, 0):
for every slot whose client SA entry is missing/zero and whose golden body
exists (kernel/golden-mme-tu104.h golden_mme_tu104_sa[64]), set the SA entry
to the golden body's IR entry (slot 34 = 0x265, 75 words) and mark it
present. Nonzero client entries are never overwritten. Fill runs in the
golden overlay, in the submit path before the stub/call-drop walk, and in
the SA re-arm (the release-carrier path); the release path re-fetches and
emits the filled 0x11c pairs. New MME-GOLDEN sa-fill/sa-census receipts.

c774 proves the fill: `MME-GOLDEN sa-fill slot=34 entry=0x265
(client=missing)`. Enable in params-r1624. Build rc 0; the mac=0x22
validation needs a c772-class release boot.

1 files changed, 135 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 40a8791..65ab874 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -18461,6 +18461,91 @@ static int gsp_phys_gr_golden_slot(u32 j, u32 *entry, const u32 **words,
 }
 
 /*
+ * r1625 SEMANTIC-GAP (sema_gl_mme_sa_golden_fill): the golden overlay
+ * writes the golden bodies into the packed IR and fills its LOCAL SA pair
+ * table, but the per-launch SA re-arm (and the stub/call-drop walk)
+ * reads the service's live START-ADDRESS RAM table - the client's own
+ * 0x11c/0x120 capture. When that capture never supplied a slot (c772:
+ * slots 0..11 only, slot 34 absent), the re-arm emits no pair for it and
+ * the release window's CALL_MME_MACRO(34) keeps the engine's stale
+ * SA[34] (0 or another macro's entry): the DRAW_IAB CALL resolves to IR
+ * offset 0 / slot 0's body and the c772 replay ran mac=0x33/0x0/0x39,
+ * never mac=0x22. Fill every golden-served slot the client table cannot
+ * serve with the same instruction entry the overlay uses, so the re-arm
+ * points the CALL at the golden DRAW_IAB body (slot 34 -> 0x265).
+ * Default 0 = byte-identical legacy behaviour (A/B).
+ */
+static bool gsp_phys_rmcall_gr_mme_sa_golden_fill;
+module_param_named(sema_gl_mme_sa_golden_fill,
+		   gsp_phys_rmcall_gr_mme_sa_golden_fill, bool, 0644);
+MODULE_PARM_DESC(sema_gl_mme_sa_golden_fill,
+	"Golden SA completion: publish a golden IR entry into the host START-ADDRESS RAM table for every golden-served slot the client capture left missing/zero, so the SA re-arm resolves CALL_MME_MACRO(j) to the golden body (default 0; A/B)");
+static u32 gsp_phys_gr_golden_fill_log;
+static u64 gsp_phys_gr_golden_fill_seen;
+static u32 gsp_phys_gr_golden_census_log;
+
+/*
+ * Fill the host SA table for all golden-served slots the client's capture
+ * cannot serve. Returns the number of entries filled this call; each slot
+ * is logged once per boot so a replayed window cannot spam the receipt.
+ */
+static u32 gsp_phys_gr_mme_sa_golden_fill(void)
+{
+	u32 j, filled = 0;
+
+	if (!READ_ONCE(gsp_phys_rmcall_gr_mme_sa_golden_fill))
+		return 0;
+	for (j = 0; j < 64u; j++) {
+		u32 gent, gn;
+		const u32 *gw;
+
+		if (!gsp_phys_gr_golden_slot(j, &gent, &gw, &gn))
+			continue;
+		if (!gsp_sema_mme_sa_fill(j, gent))
+			continue;
+		filled++;
+		if (!(gsp_phys_gr_golden_fill_seen & (1ull << j)) &&
+		    gsp_phys_gr_golden_fill_log < 64u) {
+			gsp_phys_gr_golden_fill_seen |= 1ull << j;
+			gsp_phys_gr_golden_fill_log++;
+			pr_info("vgsp-gr: MME-GOLDEN sa-fill slot=%u entry=0x%x (client=missing)\n",
+				j, gent);
+		}
+	}
+	return filled;
+}
+
+/*
+ * r1625 receipt: for every slot the replayed window calls, print the
+ * client's captured entry, the golden entry and the entry the fill
+ * publishes (and the re-arm then emits). Called BEFORE the fill, so
+ * cli_mask / cli_ent are the client's own table; bounded per boot. A slot
+ * called through both the MACRO and DATA ports logs twice by design (the
+ * receipt is the raw walk, not a deduped view).
+ */
+static void gsp_phys_gr_mme_sa_census(u32 j, u64 cli_mask,
+				      const u32 *cli_ent)
+{
+	u32 gent = 0, gn, used;
+	const u32 *gw;
+	bool have_cli;
+
+	if (!READ_ONCE(gsp_phys_rmcall_gr_mme_sa_golden_fill) ||
+	    gsp_phys_gr_golden_census_log >= 64u || j >= 64u)
+		return;
+	have_cli = (cli_mask & (1ull << j)) && cli_ent[j];
+	if (gsp_phys_gr_golden_slot(j, &gent, &gw, &gn))
+		used = have_cli ? cli_ent[j] : gent;
+	else {
+		gent = 0;
+		used = have_cli ? cli_ent[j] : 0u;
+	}
+	gsp_phys_gr_golden_census_log++;
+	pr_info("vgsp-gr: MME-GOLDEN sa-census slot=%u client=0x%x golden=0x%x used=0x%x\n",
+		j, have_cli ? cli_ent[j] : 0u, gent, used);
+}
+
+/*
  * r1448 STRATEGY 3.3 golden-only completion: with golden_force on and
  * the golden_only knob on, a slot the golden library cannot serve must
  * never execute. Returns true when the slot is outside the golden corpus
@@ -23432,6 +23517,15 @@ if (gsp_phys_gr_slot_kept(j, sa_mask,
 					u32 gj, goldn = 0, ginsp = 0;
 					u32 gblank = 0;
 
+					/*
+					 * r1625: complete the host SA table
+					 * from the same library before the
+					 * pack emission, so the per-launch
+					 * re-arm and the release window's
+					 * CALL runs resolve to these bodies
+					 * (sema_gl_mme_sa_golden_fill).
+					 */
+					gsp_phys_gr_mme_sa_golden_fill();
 					for (gj = 0; gj < 64u; gj++) {
 						u32 gent, gn, q;
 						const u32 *gw;
@@ -24458,6 +24552,39 @@ if (gsp_phys_gr_slot_kept(j, sa_mask,
 			u64 sa_mask = gsp_sema_mme_sa_get(sa_ent, 64);
 			u32 r = 0, rearm = 0;
 
+			/*
+			 * r1625 census: sa_ent/sa_mask are the client's own
+			 * table here (pre-fill); the census prints the entry
+			 * the fill publishes and the re-arm then emits.
+			 */
+			while (r < win3d_n) {
+				u32 h = win3d[r];
+				u32 op = (h >> 29) & 7u;
+				u32 cnt = (h >> 16) & 0xfffu;
+				u32 span = ((op == 1u || op == 3u ||
+					     op == 5u) && cnt &&
+					    r + 1u + cnt <= win3d_n) ?
+					   1u + cnt : 1u;
+				u32 mb = (h & 0xfffu) << 2;
+
+				if (mb >= 0x3800u && mb <= 0x39fcu)
+					gsp_phys_gr_mme_sa_census(
+						(mb - 0x3800u) / 8u, sa_mask,
+						sa_ent);
+				r += span;
+			}
+			/*
+			 * r1625: the saved-window release launch never emits
+			 * the golden overlay (emit_prelude is off), and a
+			 * client capture may have re-zeroed a slot after the
+			 * overlay ran. Complete the host SA table here - the
+			 * launch that actually runs the CALL runs - so the
+			 * re-arm below points them at the golden bodies the
+			 * pack holds (slot 34 -> DRAW_IAB at IR 0x265).
+			 */
+			gsp_phys_gr_mme_sa_golden_fill();
+			sa_mask = gsp_sema_mme_sa_get(sa_ent, 64);
+			r = 0;
 			while (r < win3d_n && rearm < 32u) {
 				u32 h = win3d[r];
 				u32 op = (h >> 29) & 7u;
@@ -31715,6 +31842,14 @@ gr_page_unmapped:
 		win3d = stream_patch;
 		win3d_n = win_n;
 		/*
+		 * r1625: publish the golden SA entries before the stub/drop
+		 * walk reads the START-ADDRESS RAM table, so a golden-served
+		 * slot the client capture never supplied (c772: slot 34) is
+		 * present for both the drop decision here and the builder's
+		 * per-launch re-arm. No-op with sema_gl_mme_sa_golden_fill=0.
+		 */
+		gsp_phys_gr_mme_sa_golden_fill();
+		/*
 		 * SESSION 153-CONTINUED-69: drop the CALL_MME_MACRO/DATA runs
 		 * of stubbed slots (see gsp_phys_gr_mme_drop_calls). With the
 		 * stub as a pure NOP terminator the parameter port no longer